angr / angr/cle

Cannot load prelinked binaries

Offen
#191 3 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
feature help wanted
Vorherrschende Sprache
Python
Sterne
485
Forks
135
Ø Merge
2 T. 2 Std.
Gemergte PRs (30 T.)
15

Beschreibung

In some Linux systems, users can employ _prelink_ (https://linux.die.net/man/8/prelink) to try to speed up startup time. I haven't dug too much into prelink's code (https://github.com/jwilk-mirrors/prelink) but surely it changes relocation entries in such a way that CLE cannot handle when loading a binary. The basic idea of prelink is to assign hard coded base addresses to shared objects so the final addresses of symbols will be known and advance and statically written in the relocation segments of ELF objects that use them.

In my view, a fix for this requires 2 things:
1) Some logic to figure out whether a relocation entry has been tampered with by prelink or not - this is because you won't find offset values in these symbols, but actual absolute addresses; so this line (https://github.com/angr/cle/blob/master/cle/backends/elf/metaelf.py#L38) will be wrong and you need to use *realaddr* instead of the from-lva-to-rva calculation.

2) Defer the PLT loading to *after* all objects have been loaded - this is because prelinked symbols will have addresses *outside* the address space of current object, so if you try to access these addresses (e.g. via self.memory.load at the line I mentioned above) you'll crash because there's no backer satisfying the target address. In fact, you may have to use self.*loader*.memory.load instead. One idea for implementing this deferring is to remove the call to _load_plt() from the ELF constructor (https://github.com/angr/cle/blob/master/cle/backends/elf/elf.py#L121) and move it to loader instead, after all objects have been mapped (e.g. circa https://github.com/angr/cle/blob/master/cle/loader.py#L682).

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.